gopay25[.]cevc[.]top

This domain, gopay25.cevc.top, was set up to trick people into thinking it was a legitimate GoPay promotion. The page title, 'Hajatan Ulang Tahun GoPay: Bagi-Bagi Saldo Rp500.000 untuk Semua Pengguna,' translates to a fake birthday giveaway offering 500,000 Indonesian Rupiah to all users. This is a classic phishing lure designed to steal login credentials or personal information from unsuspecting victims. The site impersonates the well-known payment platform GoPay, making it especially dangerous for users in regions where GoPay is widely used.

PhishDestroy identified this threat through multiple indicators. The domain was created on February 21, 2026, through Alibaba Cloud Computing Ltd. d/b/a HiChina, a registrar often abused by malicious actors. VirusTotal flagged it with 18 out of 95 security vendors marking it as malicious, which is a strong signal of its dangerous nature. The site's IP address, 188.114.96.3, is associated with Cloudflare, which can help hide the true hosting location. Additionally, the domain appears on one security blocklist and was found to have no SSL certificate, further confirming its lack of legitimacy. The brand targeted was manta, but the page title references GoPay, indicating a possible typo or misdirection in the intelligence data.

If you or someone you know visited this site, do not enter any personal information. Immediately change your GoPay password and any other accounts that share the same credentials. Monitor your financial accounts for unusual activity and enable two-factor authentication where possible. It is also a good idea to run a full antivirus scan on your device to check for any malware that might have been downloaded. Stay vigilant and always verify URLs before clicking on promotional offers. If you believe your data has been compromised, contact GoPay's official support team for further assistance.